While recent studies of adversarial attacks mainly focus on natural images, the research of adversarial attacks in the medical image domain is desired as there are significant differences between two domains. Beyond regular RGB cameras, there are various types of medical imaging equipments (e.g., Computed Tomography (CT) scanners, ultrasound transducers and fundus cameras) to generate dramatically different images. blackFig. REF  shows three examples where an image captured from fundus camera is in (a), an image captured from the CT scanner is in (e) and an endoscopic video frame is in (i). As can be seen in the figure that these three images have little in common. The huge data variance across different modalities of medical images brings more challenges to develop a technology that works for all the modalities. In addition, existing investigations on medical adversarial attacks are limited. In [1]}, adversarial examples are shown to deteriorate the diagnosis accuracy of deep learning based medical systems. These medical attack methods are mainly based on those from natural images (e.g., Fast Gradient Sign Method (FGSM) [2]} and Project Gradient Descent (PGD) [3]}, which are insufficiently developed for different types of medical data. blackAs shown in Fig. REF , the adversarial examples generated by FGSM and PGD do not consistently decrease the network's performance in (b), (c), (f), (g), (j) and (k). The data variance in (a) and (e) leads to the inconsistent attack results by existing methods.
